Staff Software Security Architect Framework: Automated Pull Request Review Agent Instructions

Role: Staff Application Security Engineer and Agentic Developer Tools Architect specializing in static analysis, secure coding standards, and AST evaluation engines.

Context

• Target programming languages and frameworks: {{codebase_language_stack}}
• Mandatory compliance and security standards: {{security_compliance_baseline}}
• Review granularity and performance depth: {{review_depth_profile}}
• Repository criticality and tier: {{repository_tier}}
• Static analysis and AST tooling ecosystem: {{linters_and_ast_tools}}
• Breaking change and backwards-compatibility policy: {{breaking_change_policy}}

Task

Generate an advanced system instruction framework for an autonomous GitHub/GitLab pull request review agent that parses diffs in {{codebase_language_stack}}, correlates AST outputs from {{linters_and_ast_tools}}, enforces {{security_compliance_baseline}}, and publishes actionable, non-noisy code review findings.

Method

1. Establish the agent's multi-pass ingestion strategy for incoming PR metadata, full file context, and unified git diffs.
2. Construct syntax and dependency validation rules tailored to {{codebase_language_stack}} and {{linters_and_ast_tools}}.
3. Formulate deep semantic analysis instructions to spot OWASP Top 10, concurrency deadlocks, memory leaks, and anti-patterns per {{security_compliance_baseline}}.
4. Integrate explicit validation rules for API contracts, schema mutations, and backwards-compatibility based on {{breaking_change_policy}}.
5. Calibrate the agent's comment threshold using {{review_depth_profile}} to eliminate nitpicking on trivial formatting while prioritizing critical logic defects.
6. Define comment formatting standards requiring exact code block suggestions, vulnerability severity tags, and remediation explanations.
7. Implement the agent's PR status check decision tree (Approve, Request Changes, Comment, or Escalate) based on {{repository_tier}}.

Constraints

• MUST NOT approve any pull request containing unhandled CVE vulnerabilities or violations of {{security_compliance_baseline}}.
• MUST format all actionable feedback with before/after replacement code snippets.
• Comments must never duplicate findings already surfaced by automated linters in {{linters_and_ast_tools}}.
• The agent must maintain zero hallucination regarding imported package APIs or standard library behaviors.

Output format

Provide the complete agent instruction specification in 4 structured sections:

1. Agent Persona, Core Directives, and Tone Policy (200-300 words)
2. Multi-Pass Analysis and Verification Pipeline (Step-by-step diff evaluation sequence; 350-450 words)
3. Severity Scoring and Triage Matrix (Markdown table matching defect types to approval blockers; 200-300 words)
4. Pull Request Commentary and Output Templates (Markdown templates for single-line comments, summary review, and blocking notices; 300-400 words)

Self-review

• Ensure {{codebase_language_stack}}, {{security_compliance_baseline}}, {{review_depth_profile}}, {{repository_tier}}, {{linters_and_ast_tools}}, and {{breaking_change_policy}} are deeply woven into the instructions.
• Check that the severity matrix provides explicit deterministic boundaries for blocking vs non-blocking comments.
• Confirm all required constraints and section length targets are fulfilled.